Somewhere in every audited company is the mapping spreadsheet: standard clauses down one column, your documents down another, built in a heroic week before the last audit and stale within a quarter. It goes stale because it lives apart from the documents it describes: policies change, the spreadsheet does not, and by the next audit someone rebuilds it from scratch.
Requirement references move that mapping onto the documents themselves. Each policy carries a free-text reference field where you record what it answers: ISO 7.5.3, CARF 1.A.2, SOC 2 CC1.4, clause 9 of your biggest customer’s contract, or your own internal control numbering. Your standard, your dialect, your judgment, attached where it cannot drift away from the document it describes.
How it works
Free text, on purpose. The field takes whatever framework language you use, because we never supply or maintain regulatory content. There is no dropdown of ISO clauses to buy, no pre-built package deciding what maps where. If your consultant runs a bespoke methodology, the field speaks it natively. Bring your own standard is the design, not a limitation.
Group-by view. Flip the library to group by reference and the mapping spreadsheet appears, alive: every document answering 7.5.3 in one place, every clause with its documents beneath it. When a policy is revised, its references ride along; the view is never staler than the library itself.
One export, built for an auditor, with gaps flagged before you send it
The export column. References travel with exports, so the roster you hand an examiner arrives pre-organized by the clauses they are auditing against, in the numbering they expect, because it is the numbering you recorded.
What this deliberately is not
Requirement references are a map, not a verdict. There is no coverage percentage, no gap score, no dashboard announcing you are “87% compliant with ISO 27001,” and there never will be, because a reference records your claim that a document addresses a clause. Whether it addresses it well is a judgment that belongs to you, your consultant, and finally your auditor. Software that grades that judgment for you is selling a verdict it has no standing to give. We keep to facts: this document, mapped to this clause, by you, on this date.
That is also why the field pairs naturally with a consultant-run gap analysis: the consultant’s craft is deciding what answers what; the field is where the decision lives so it survives the engagement. Consultants have their own page (/for-consultants).
Where it earns its keep
At audit time, grouped references answer the auditor’s organizing question (“show me what addresses clause X”) in their own vocabulary. Between audits, the group-by view is the standing answer to “do we have anything for this requirement,” which is the question every new customer contract and every new framework adoption starts with. And at handoff, when the person who built the mapping leaves, the mapping stays, on the documents, in plain text, legible to their successor. The heroic spreadsheet week retires.
Start your 30-day free trial. No credit card to start, and a 30-day money-back guarantee if you convert and change your mind.
Not ready for a trial? On annual plans, migration is on us: we’ll move your docs from SharePoint, Google Drive, Confluence, or Notion and have you running in about a week.
Vikas is a B2B marketing professional with over 14 years of experience in content strategy, messaging, and demand generation. He specializes in turning complex business challenges into clear, actionable stories to connect meaningfully with audiences.
